Remote VASP serving residents in Panama
Foreign-incorporated entity that offers exchange, custody, or transfer services to residents of a jurisdiction without establishing a local entity or office.
Remote VASP is conditionally permitted in Panama with a local entity, subject to AML obligations and medium licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Medium
- Last updated
- 2026-07-13
AML Obligations
- Register with the Superintendencia de Bancos de Panamá (SBP) as a Virtual Asset Service Provider (VASP) under Law 1 of 2024, which amends Law 23 of 2015.
- Conduct Customer Due Diligence (CDD): identify and verify customers and beneficial owners using reliable, independent source documents (government-issued ID, passport, proof of address).
- Understand the purpose and nature of the business relationship; gather information on expected transaction types and source of funds/wealth.
- Perform ongoing monitoring of business relationships and transactions to ensure consistency with the customer's risk profile.
- Apply Enhanced Due Diligence (EDD) for high-risk customers, including PEPs, customers from high-risk jurisdictions, and transactions involving new or anonymity-favoring technologies.
- Report suspicious transactions (STRs) to the Unidad de Análisis Financiero (UAF) — obligation applies regardless of amount.
- Maintain records for at least 5 years after the business relationship ends or after the date of the transaction.
- Implement internal AML/CFT policies, controls, and risk assessments as required under Law 23 of 2015 and Executive Decree 44 of 2016.
- Comply with no-tipping-off prohibition — cannot disclose to customers or third parties that an STR has been or will be filed.
Key Restrictions
- Must be incorporated under Panamanian law (Public Registry) and obtain a business license ('Aviso de Operación') from the Ministry of Commerce and Industries.
- Must register with the SBP as a VASP under Law 1 of 2024 — a non-resident entity cannot serve Panama residents from abroad without local incorporation and SBP registration.
- If the virtual assets constitute securities under Law Decree 1 of 1999, a broker-dealer or investment adviser license from the SMV may be required.
- If services involve holding significant fiat balances for clients resembling banking, a banking license under Law Decree 2 of 2008 may be triggered — highly stringent.
- No Travel Rule-specific legislation is in effect; general AML/CFT obligations apply but without a mandated VASP Travel Rule threshold or technical standard.
Key Risks
- Enforcement risk for unlicensed remote operators is significant — SBP has repeatedly warned that crypto activities are not regulated/supervised by them and has cautioned financial institutions against involvement with unlicensed crypto entities.
- Panama was on the FATF grey list until October 2023; ongoing FATF pressure on AML/CFT enforcement means regulators are increasingly active against unregistered VASPs.
- Bill 697 (which would have created a comprehensive crypto licensing framework) was partially vetoed in 2022 — regulatory uncertainty persists and enforcement may rely on general financial laws.
- Lack of a specific crypto Travel Rule creates ambiguity about technical compliance requirements for cross-border VA transfers.
- If classified as a securities or banking activity, failure to obtain the appropriate license could result in administrative sanctions, fines, or criminal penalties under Law 23 of 2015.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
No Crypto-Specific Licensing Regime: As of late 2023 / early 2024, there is no specific "virtual asset license" in Panama issued by a dedicated crypto regulator.
Be incorporated under Panamanian law (Public Registry).
Obtain a business license ("Aviso de Operación") from the Ministry of Commerce and Industries.
Applicability: Exchanges, custody providers, and payment processors dealing with virtual assets are highly likely to be considered "Designated Non-Financial Businesses and Professions" (DNFBPs) or fall under an extended interpretation of "financial activities" for AML purposes.
Requirement: While not a "license," these entities would need to register with the SSNF for AML/CFT oversight and comply with all associated requirements.
Regulatory Reference: Law 23 of 2015 (Ley 23 de 2015, que adopta medidas para prevenir el blanqueo de capitales, el financiamiento del terrorismo y el financiamiento de la proliferación de armas de destrucción masiva). This law designates certain entities as "obligated subjects" (sujetos obligados) for AML/CFT purposes. While it doesn't explicitly name "VASPs," its broad scope and subsequent interpretations can cover them.
Law 1 of January 5, 2024 (Ley No. 1 de 5 de enero de 2024): This is the most crucial and recent piece of legislation specifically for virtual assets. It amends Law 23 of 2015 and other related laws to define virtual assets and virtual asset service providers (VASPs), establish a licensing and supervision regime, and explicitly subject VASPs to AML/CFT obligations under the supervision of the Superintendency of Banks of Panama (SBP). This law ensures Panama's compliance with FATF Recommendation 15 on new technologies and VASPs.
Superintendencia de Bancos de Panamá (SBP) - Superintendency of Banks of Panama:
Unidad de Análisis Financiero (UAF) - Financial Analysis Unit of Panama:
Identification and Verification:
Ongoing Monitoring: Continuously monitoring the business relationship and transactions to ensure consistency with the VASP's knowledge of the customer, their business, and risk profile. This includes scrutinizing complex, unusual large transactions, and all unusual patterns of transactions that have no apparent economic or lawful purpose.
Enhanced Due Diligence (EDD): Applying EDD measures for high-risk customers, business relationships, or transactions, which include:
Obligation to Report: VASPs are legally obligated to report any suspicious transaction or activity to the UAF, regardless of the amount. A transaction is suspicious if the VASP has reasonable grounds to suspect that it may be related to money laundering, terrorism financing, or other illicit activities.
No Tipping-Off: VASPs, their employees, and officers are prohibited from disclosing to the customer or any third party that an STR has been or will be submitted.
Duration: Records must typically be kept for at least five (5) years after the business relationship has ended or after the date of the transaction.
Evolving Regulatory Framework: Panama has been discussing comprehensive cryptocurrency regulation, most notably with Bill 697, which was partially vetoed in 2022. This lack of a clear, dedicated crypto legal framework means that enforcement would likely fall under existing general financial laws (e.g., anti-money laundering, fraud), making it harder to categorize specifically as "crypto enforcement."
Focus on AML/CFT: Panama was on the FATF grey list until October 2023, which heavily emphasized improving its Anti-Money Laundering and Counter-Financing of Terrorism (AML/CFT) regime. While this pressure indirectly affects crypto (as it's a known vector for financial crime), direct, high-profile enforcement actions against crypto entities with specific fines haven't been widely publicized as a result.
Regulator Name: Superintendencia de Bancos de Panamá (SBP) - Banking Superintendent of Panama
SBP Circulars and Statements on Crypto Risks:
Failed Cryptocurrency Law (Bill 697):
No specific, comprehensive law for virtual assets and VASPs fully implementing the Travel Rule has been adopted and made effective.
Status of Law 69/2022: This law was vetoed by the President of Panama in June 2022, primarily due to concerns about its scope, regulatory framework, and potential implications for financial stability and existing AML/CFT efforts. This means it did not become law.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — a non-resident provider may serve Panama residents only after incorporating locally under Panamanian law, obtaining a business license, and registering with the SBP as a VASP under Law 1 of 2024, with full AML/CFT obligations under Law 23 of 2015.
Questions this verdict aims to answer
- May a non-resident provider serve residents from abroad?
- Does cross-border service trigger licensing, registration, or AML obligations?
- What enforcement risk exists for unlicensed remote operators?